Archive for the ‘SysAdmin Notices’ Category

Mail Server Change – How the SPAM filtering is configured

Saturday, April 14th, 2007

Sent 2/28/2006

———————–

Greetings,

Now that I had a short nap here is some info on the new changes and how they affect SPAM.

You will notice that some of the emails will have a tag added to the subject line of SPAM-LOW or SPAM-MED. The new mail server has three threshold settings: Low, Medium & High. Those determinations are made by “weighting” each piece of mail.

For example we currently are assigning the following weights (links at the bottom that describe these type of tests:

Tests Weight

Bayesian Filtering 15
SPF
SPF-Pass -15
SPF-Fail 10
SPF-SoftFail 5
SPF-Neutral 0
SPF-PermError 0
SPF-None 0
Reverse DNS 10
Blacklists (RBL)
AHBL 10
DSBL 10
NJABL 15
ORDB 10
SpamCop 10
SpamHaus SBL-XBL 10

(more…)

Last Night – Mail Server Change

Saturday, April 14th, 2007

Sent 2/28/2006

————————-

Greetings,

The new email and web servers were installed last night (note the time I am sending this email). The migration went fairly smooth with no real issues noted so far.

Not all the updates that are planned have yet been implemented. Notably new and better Virus and SPAM filtering. For the short term you “may” actually see a slight increase in SPAM as the current base filters begin to “learn”. The new filtering package to come in the near term will dramatically cut down on the amount of SPAM delivered to your inbox. We did not want to do a wholesale change in one night (to the extent that we were required simply by the move to new Server hardware) so as to minimize potential problems.

Given the current time I “may” not be too quick to answer the phone in the early part of the morning should you discover some unforeseen issues so please bear with us as we continue with this migration.

Another use asked the question yesterday if the method to login to the webmail was going to change. The answer is no. You will still point your browser at your domain with an indicated port of 8383 (for example: http://www.microworks.net:8383). The first time you login through the web it will ask you some questions:

(more…)

Tonight – Mail Server update/change!

Saturday, April 14th, 2007

Sent 2/27/2006

——————

Greetings,

As previously announced we will be upgrading/replacing/consolidating our mail and web servers. This change is planned for late this evening (2/27/06) – sometime between the hours of 9pm – 11pm. During this period you will not have access to your email or website. There is also the possibility that the migration may take a bit longer. Therefore, if you are still unable to reach your mail after 11pm this may be the reason.

Test migrations have so far been without significant issue and we do not anticipate any problems with the transfer of the Websites or the Mail Servers. However, we are not as sure on the migration of FTP accounts. Since the vast majority of accounts on the servers do not have FTP access (if you even have to wonder if you have FTP access you don’t) this issue will be extremely limited in its impact. If you have had FTP access and suddenly find on Tuesday morning that you no longer do we will have to deal with it on a case by case basis.

At first planned on doing this migration over a weekend but decided that in the event of a problem not having access to your mail for a period of time in the middle part of the week would be better than starting the week off without access.

(more…)

Mail Server update/change

Saturday, April 14th, 2007

Sent 2/14/2006

————————–

Over the next couple of weeks we will be upgrading and consolidating our mail servers. We will also be switching the mail server from Ipswitch’s IMail Server to SmarterTools SmarterMail Server. Additionally we will be implementing some very advanced Anti-Spam & Virus filtering with this new server by utilizing Declude.

The changes will occur over a weekend to minimize downtime. For those using mail clients like Outlook, Outlook Express, Eudora, etc… You will be required to use SMTP Authentication. Well prior to the mail server change another email will be sent out with links to some webpages that will clearly document how to configure these three email programs. Additionally, we will provide documentation so that if you are sitting on a network like Cox Cable that “requires” you to use the Cox mail server for sending email you will be able to configure your email client to go directly to your own email server instead.

This authentication will not be forced with the initial roll out of the server but will be required within a few weeks of the new server implementation.

(more…)

Viruses/Worms, Spyware/Adware, Spam and Patches

Saturday, April 14th, 2007

Sent 5/1/2004

————————

Spam:
As you know we have some fairly aggressive filters in place for blocking most “Spam”. As of midnight last night covering the last two week period the servers have delivered 40,635 pieces of mail while summarily deleting 29,190 pieces for failing the multiple public “Black-list” tests and quarantining another 6050 for failing word, phrase, statistical and our own internal blacklist. Of those that were quarantined a total of 42 were determined either through our own examination or through a follow-up request (21 such requests) of the automated “bounce” message that is generated and sent when an email triggers the filters. This numbers show that we are running a “false positive” of only 0.16% during this period. Obviously, more spam gets through the filters than that which are falsely tagged as being spam. So I would say that our filters appear to be set as close to perfect as we can at this point.

Viruses/Worms:
We are also filtering mail for the presence of attachments that appear to have the type of files that could carry viruses and worms. We are not filtering .ZIP files which the virus and worm writers have started using and they have even started using .CPL files which we also do not filter (these are the type of program that is run from the Windows Control panel. We urge you to make sure that you are running up to date anti-virus software and that the software is updating daily. But even if you are doing that you are still at risk and your own intelligence needs to be your first line of defense. Just because an email appears to be from someone you know does not guarantee that it is safe. If an email arrives with an attachment make sure that the subject of the email and the message inside the email actually are personalized to you and talk about the attachment. If you are still in doubt as to if an attachment is valid or not simply reply to the person that sent it to you and ask them before you open the attachment. If it is valid they will reply and tell you yes if not then delete it!

(more…)

How the Servers check for spam – Full Explanation

Saturday, April 14th, 2007

Sent 4/6/2004

————————

Still doing some additional “tweaking” on the spam settings on the servers.

As part of these adjustments this evening I prepared a full and complete explanation of the process that all email goes through before being delivered to your in-box. While some spam still gets through the filters we have certainly cut it way back and the amount of email being caught that is actually valid is still running way below 0.75%.

This link will take you to the explanation of how the system works. Incidentally, this link is now included in the bounce message that is generated and sent automatically to anyone that has a message caught in the filters.

http://www.summitinternetservices.com/tests.htm

As always if you have questions or comments on our service please let us know.

Dave Riddle
Technical Director
Summit Internet Services

Mail Servers updated this weekend

Saturday, April 14th, 2007

Sent 4/4/2004

——————————–

Greetings,

This weekend we upgraded the mail servers from IMail version 8.05HF2 to version 8.1.

Some of the changes you may notice in using your email accounts on the server.

1. The web interface to access mail has changed dramatically and so far appears to be run quite a bit faster than the older version.

FYI: in case you have never used the web interface you can access your mail remotely by going opening a web browser (Internet Explorer, etc…) and entering http://www.domainname.com:8383 where domainname.com is the name of your hosted domain. Then just enter your username and your email password and you have access to any new mail that has come into the server since you last checked your mail. Plus you can send mail through this same application.

2. Mail that is either caught in the spam filters or triggers the filters to examine the mail will insert some information in the subject line of the message. The benefit for you is that should a potential spam email show up in your in-box (email that did not trip enough triggers to actually be quarantined) it will have an obvious flag indicating that it might be spam.

(more…)

A Word on eMail Viruses

Saturday, April 14th, 2007

Sent 3/19/2004

———————————

Yesterday I got the following email and since it is probably a topic that many of you are concerned about I thought I would take a minute of your time to answer it and provide some recommendations.
———
“dave,
Two days ago I got 2 viruses through email, what can I do to make sure I don’t get another one?”
———

The short answer to making sure you “don’t get another one?” is to stop using email. Of course that is unrealistic so what can you do?

The first line of defense against a virus is for you to practice “safe computing”. That means that you should follow these simple steps to help reduce your risk.

(more…)

Update – Spam + Attachment filtering

Saturday, April 14th, 2007

Sent 3/12/2004

—————————–

Just a quick note at the end of the week to let you know about how the additional configurations on spam and attachments have been working out.

This morning we added (and replaced) some additional “black-hole” lists that our server checks against to identify known sources of spam. These lists are:

http://www.spamhaus.org
http://www.spamcop.net
http://dsbl.org/main
spamsources.fabel.dk
http://www.ahbl.org
http://www.njabl.org
http://cbl.abuseat.org

(more…)

Spam + Attachment filtering now implemented

Saturday, April 14th, 2007

Sent 3/3/2004

————————-

Greetings, customers on the Summit Internet Services – Email/Web Services please see updated info below on both our on-going Spam filtering and our new Attachment Filtering!

Spam Update
————————
As you are aware, we implemented “Spam” filtering on the server in the middle of last year and while some spam still get’s through the amount being blocked is really impressive. For example: as of midnight last night or statistics show that for the preceding fourteen days (looking at just Monday – Friday traffic) the mail server handled 53,566 pieces of email. Of that, the Server identified 12,994 pieces as probable “spam” and quarantined those messages. We are still doing cursory reviews of ALL mail that is caught and redirecting them to you. However, while 70 such messages were
redirecting as part of the review only 12 of those messages were actually redirected due to the person that sent the original message requesting that the review be conducted per the instructions that were bounced back to them when their message was originally caught. Still, this demonstrates that we are only having a 0.54% “false-positive” for valid email that are being trapped by the filters.

(more…)